Storage Tiering Service  ·  View 28 of 31  ·  7 · Assurance

Security: Trust Zones

Six zones ordered by exposure, the identity each crossing uses, and why a compromised mover can copy data but cannot destroy it.

Editable source SVG draw.io All views
Product network File service tenant token Serving plane Placement resolver catalogue read-only Recall API per-tenant authz Tiering plane Mover workers PUT-only · 15 min Compromised mover can copy, not delete Release Release gate DELETE if committed Data Catalogue grants per role Ceph RGW STS roles · SSE-KMS Custody OpenBao tenant keys Decision records Object Lock · 3 y mTLS PUT only DELETE denied DELETE source key id kept Security — Trust Zones and What Each Identity May Do External / third party Interface / broker Application we own Risk / gap Security / platform Data store synchronous failure / alternate No principal holds both a movement role and a delete role. Removing a hold or pin needs two named approvers and is written to the locked record first. v 1.0 · owner Security Architecture · date 2026-09

Decisions

  • Movement and deletion are separate principals in separate deployments. Movers can PUT into a named destination tier; only the release gate can DELETE, and only a source whose destination the catalogue records as committed (ADR-29).
  • The resolver carries the caller's tenant token through to authorisation. An object is not readable to anyone because it is cold, and not unreadable because it is hot.
  • SSE-KMS key ids are recorded per placement and per pack, and the mover writes with the source's key id. A movement never re-keys or de-keys an object.

Threats considered

  • A compromised mover: can exfiltrate what it may read and write copies; cannot delete. Bounded to 15-minute credentials scoped to one tier.
  • A malicious hold removal: needs two approvers and is written to the Object-Locked record before it takes effect.
  • Bulk recall as staging for exfiltration: every job names a principal and an authority, and is reviewed by security above 1 million objects.

Assumption

  • The file service authenticates end users. The tiering service authorises tenants and roles, and never sees end-user credentials.
◀  Roadmap All views Short-Lived Credentials  ▶
Solution Architecture v1.0 · Storage Platform Architecture · 2026-09 · 31 views · open source, fully on-premises28-security-trust-zones